add negative test for HttpStandardHeadersScenario

Self-contained vitest that POSTs initialize with and without Mcp-Method,
asserts FAILURE/SUCCESS on the pinned check id, and proves getChecks() is
idempotent. No example client/server file needed for this one because the
scenario *is* the server — the test crafts the bad request directly.

This is the negative-test half of AGENTS.md §Testing your scenario; the
everything-client passing-example half is still TODO.

Author: pcarleton

src/scenarios/client/http-standard-headers.test.ts

@@ -0,0 +1,76 @@
+import { describe, it, expect } from 'vitest';
+import { HttpStandardHeadersScenario } from './http-standard-headers';
+
+/**
+ * Negative test for SEP-2243 standard-header checks: a client that omits
+ * Mcp-Method on a POST must produce a FAILURE row, and one that includes it
+ * must produce SUCCESS. Pins the check id so coverage is tracked.
+ */
+describe('HttpStandardHeadersScenario (SEP-2243) — negative', () => {
+  async function postInitialize(
+    serverUrl: string,
+    extraHeaders: Record<string, string>
+  ): Promise<void> {
+    await fetch(serverUrl, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+        ...extraHeaders
+      },
+      body: JSON.stringify({
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'initialize',
+        params: {
+          protocolVersion: 'DRAFT-2026-v1',
+          clientInfo: { name: 'neg-test', version: '0' },
+          capabilities: {}
+        }
+      })
+    });
+  }
+
+  it('FAILs client-mcp-method-header-initialize when Mcp-Method is missing', async () => {
+    const scenario = new HttpStandardHeadersScenario();
+    const { serverUrl } = await scenario.start();
+    try {
+      await postInitialize(serverUrl, {}); // no Mcp-Method header
+      const checks = scenario.getChecks();
+      const check = checks.find(
+        (c) => c.id === 'client-mcp-method-header-initialize'
+      );
+      expect(check?.status).toBe('FAILURE');
+    } finally {
+      await scenario.stop();
+    }
+  });
+
+  it('SUCCEEDs client-mcp-method-header-initialize when Mcp-Method matches', async () => {
+    const scenario = new HttpStandardHeadersScenario();
+    const { serverUrl } = await scenario.start();
+    try {
+      await postInitialize(serverUrl, { 'Mcp-Method': 'initialize' });
+      const checks = scenario.getChecks();
+      const check = checks.find(
+        (c) => c.id === 'client-mcp-method-header-initialize'
+      );
+      expect(check?.status).toBe('SUCCESS');
+    } finally {
+      await scenario.stop();
+    }
+  });
+
+  it('getChecks() is idempotent', async () => {
+    const scenario = new HttpStandardHeadersScenario();
+    const { serverUrl } = await scenario.start();
+    try {
+      await postInitialize(serverUrl, { 'Mcp-Method': 'initialize' });
+      const first = scenario.getChecks();
+      const second = scenario.getChecks();
+      expect(second.length).toBe(first.length);
+    } finally {
+      await scenario.stop();
+    }
+  });
+});